The HIPAA Privacy Rule generally requires covered entities—such as health plans, health care providers, and health care clearinghouses—to give individuals a Notice of Privacy Practices (Privacy Notice). This notice explains how their protected health information (PHI) may be used or shared and outlines their rights related to PHI.
In April 2024, the U.S. Department of Health and Human Services (HHS) issued a final rule requiring updates to Privacy Notices for certain patient records. Specifically, covered entities that receive or maintain records from substance use disorder (SUD) treatment provided by a federally assisted “Part 2 program” must update their Notices to include:
-
A statement that SUD treatment records (or related testimony) cannot be used or disclosed in any civil, criminal, administrative, or legislative proceeding against the individual unless the person provides written consent, or a court order is obtained after notice and an opportunity to be heard.
-
If the entity plans to use or share Part 2 program records for fundraising, a statement that individuals must be given a clear and prominent way to opt out of fundraising communications.
The deadline to implement these updates is February 16, 2026.
Privacy Notice Requirements
-
Self-insured health plans must maintain and provide their own Privacy Notice at enrollment, when a material change occurs, and upon request.
-
Fully insured plans without access to PHI (other than enrollment and summary health information) are not required to maintain or provide a Privacy Notice.
-
Fully insured plans with PHI access must maintain a Privacy Notice and provide it upon request.
Model Notices
HHS offers [model privacy notices] for health care providers and health plans. Entities using these templates should update them to meet the new requirements for SUD records. It is unclear if HHS will update its models before the compliance deadline.
Employer Action Steps
Employers must update any Privacy Notices for their health plans to reflect the new protections for SUD treatment records by February 16, 2026. Employers with self-insured health plans must also distribute the updated Notices by this date.
For guidance on updates and benefits plan management,